Hackers are breaching WordPress sites by exploiting a vulnerability in outdated versions of the Popup Builder plugin, infecting over 3,300 websites with malicious code.
The flaw used in the attacks tracked as CVE-2023-6000, is a cross-site scripting (XSS) vulnerability impacting Popup Builder versions 4.2.3 and older, which was initially disclosed in November 2023.
A Balada Injector campaign uncovered this year exploited the particular vulnerability to infect over 7100 websites, indicating that many site admins hadn’t patched quickly enough.
Now Sucuri researchers report spotting a new campaign targeting the same vulnerability on the WordPress plugin.
According to PublicWWW results, code injections linked to this latest campaign are to be found in 3,329 WordPress sites, with Sucuri’s own scanners detecting 1,170 infections.
The attacks infect the Custom JavaScript or Custom CSS sections of the WordPress admin interface, while the malicious code is stored within the ‘wp_postmeta’ database table.
The primary function of the injected code is to act as event handlers for various Popup Builder plugin events, such as ‘sgpb-ShouldOpen’, ‘sgpb-ShouldClose’, ‘sgpb-WillOpen’, ‘sgpbDidOpen’, ‘sgpbWillClose’, and ‘sgpb-DidClose.’
By doing that, malicious code executes at specific actions of the plugin, like when a popup opens or closes.
The researchers says the primary purpose of the injections appears to be redirecting visitors of infected sites to malicious destinations such as phishing pages and malware-dropping sites.
These attacks originated from two domains registered on February 12th, “ttincoming.traveltraffic[.]cc” and “host.cloudsonicwave[.]com,” so blocking these two is recommended.
Those who are using the Popup Builder plugin on their site must upgrade to the latest version, currently 4.2.7, which addresses CVE-2023-6000 and other security problems.
WordPress stats show that at least 80,000 active sites currently use Popup Builder 4.1 and older, so the attack surface remains significant.
Admins of already infected WordPress websites must delete malicious injection from the “Custom JS or CSS” section of the Popup Builder in the WordPress admin interface. Then they have to scan their website at the client and server level to find any hidden website backdoors and remove it.
Comments